When you take a pill, inject a vaccine, or use a medical device, you expect it to be safe. But how do you know the company that made it followed the rules? The answer lies in manufacturing transparency - and the FDA’s ability to inspect and access records from every facility that produces drugs and medical devices in the U.S. and abroad.
What the FDA Can and Can’t See
The FDA doesn’t just show up and ask for paperwork. They have legal authority under Section 704(a)(1) of the Federal Food, Drug, and Cosmetic Act to enter any manufacturing site and review records tied to current Good Manufacturing Practices (CGMP). But there’s a critical line they’re supposed to respect.Internal quality audits - the kind companies run to find their own problems before the FDA does - are generally protected. Under Compliance Policy Guide Sec. 130.300, the FDA won’t review these unless there’s a specific reason to suspect serious misconduct. This policy was designed to encourage honest self-audits. If companies feared every internal mistake would become public, they’d stop looking for problems.
But here’s what the FDA can demand at any time: production logs, batch records, validation reports, deviation investigations, and corrective action plans (CAPAs). If a batch of insulin fails a purity test, the company must document why, how they fixed it, and what they’re doing to prevent it again. Those records are open for inspection. The same goes for customer complaints about a device malfunction or a lab result that doesn’t match the label.
Record Keeping Rules: How Long and What Exactly?
It’s not enough to just keep records. You have to keep them the right way.For pharmaceuticals, 21 CFR 211.180 says records must be kept for at least one year after the product’s expiration date. That means if a drug expires in 2027, the company must still have all its production and testing documents from 2024 on file. For medical devices, it’s even longer: records must be kept for the life of the device plus two years. If you used a pacemaker implanted in 2020, the manufacturer must still have its design and testing files until at least 2042.
And these aren’t just files tucked away in a drawer. They must be contemporaneous - meaning recorded at the time the action happened. If a technician adjusts a machine setting at 3:15 p.m., the log entry must be made then, not rewritten at the end of the shift. In 2024, 22% of FDA warning letters cited backdated or incomplete records as a primary violation.
Inspection Types: Routine, For-Cause, and Remote
Not all FDA inspections are the same. In 2024, about 75% were routine surveillance checks - scheduled visits to monitor ongoing compliance. These focus on standard CGMP areas: cleaning procedures, equipment calibration, personnel training, and environmental controls.Then there are “for-cause” inspections - triggered by complaints, adverse events, or data anomalies. These are deeper. When the FDA suspects a pattern of failure, they can demand access to internal audit reports, employee interviews, and even emails about quality issues. In 2024, these made up 18% of inspections and were far more likely to result in formal findings.
Since July 2025, the FDA has also been using Remote Regulatory Assessments (RRAs). These aren’t inspections. They’re virtual reviews where companies share digital records, grant read-only access to databases, or do live video walkthroughs. RRAs don’t generate Form 483s, but they’re becoming a regular part of oversight. By Q1 2025, 73% of Fortune 500 drugmakers had built systems to support RRAs because they reduce downtime and let companies prepare better.
What Happens When the FDA Finds Problems?
If inspectors spot something wrong, they leave behind Form FDA 483 - a list of observations. It’s not a citation. It’s not a fine. But it’s serious. Companies have exactly 15 business days to respond with a detailed corrective plan.Here’s the catch: a weak response can turn a 483 into a warning letter, and a warning letter can lead to import bans, product seizures, or even criminal charges. In 2024, companies that used FDA-recommended root cause analysis methods closed 89% of their 483s within six months. Those that gave vague answers or ignored the real issue? Only 62% got resolved.
Merck’s QA manager, David Chen, said the 15-day window is brutal during peak production seasons. “You’re scrambling to fix a problem, write a report, and get it approved - all while your team is working double shifts.” That pressure is why 78% of pharmaceutical manufacturers now have dedicated inspection readiness teams.
Foreign Facilities: A New Era of Surprise Inspections
More than half of the active pharmaceutical ingredients used in U.S. medicines come from overseas. Until recently, the FDA could only inspect foreign sites if they were scheduled - and even then, companies often knew weeks in advance.In May 2025, the FDA announced a major shift: unannounced inspections of foreign facilities will jump from 12% of visits in 2023 to 35% by the end of 2025. That means a plant in India or China could wake up one morning to find FDA inspectors at the gate - no warning, no prep time.
This change follows a 2024 GAO report that found foreign facilities were more likely to have repeat violations. The FDA’s goal? To close the gap between domestic and international compliance. Domestic facilities still get scheduled inspections 92% of the time. Foreign ones? That safety net is disappearing.
The Cost of Being Ready
Preparing for FDA inspections isn’t optional - it’s expensive. According to a 2025 benchmarking study of 120 facilities, companies spend an average of $385,000 per year on inspection readiness. That includes staff training, document management systems, mock audits, and consultants.Onboarding a new quality professional takes 6 to 9 months. Certification through RAPS (Regulatory Affairs Professionals Society) improves readiness by 37%, according to 2024 data. And it’s not just about paperwork. Companies must train employees to understand the difference between protected internal audits and mandatory quality investigations - a distinction that confused 63% of quality professionals in one Pfizer survey.
And the market is responding. The global pharmaceutical compliance software market hit $12.7 billion in 2024 and is growing at 8.3% per year. Tools that automate record retention, flag deviations in real time, and generate audit-ready reports are no longer luxury items - they’re survival tools.
What’s Next? More Pressure, More Tech
Congress is pushing for more transparency. The 2024 Pharmaceutical Supply Chain Transparency Act (S. 2884) proposed making certain inspection findings public - something the drug industry strongly opposes, arguing it would scare companies out of doing honest internal reviews.The FDA’s own 2025-2027 plan aims to cut inspection cycle times by 25% using digital records and AI-assisted risk scoring. At the same time, enforcement is tightening. Warning letters for companies that delay or deny inspection access rose 17% in Q1 2025 - a clear signal: if you won’t let the FDA in, they’ll find other ways to shut you down.
Manufacturing transparency isn’t about spying on companies. It’s about building trust. The FDA doesn’t need to see every internal email. But they do need to know that when something goes wrong, the company found it, fixed it, and learned from it. That’s the real goal - not perfect records, but honest systems.
How to Prepare Without Overreacting
If you work in manufacturing, here’s what actually works:- Separate internal audit reports from quality investigation records - keep them in different folders, with clear labels and access controls.
- Train every team member on what “contemporaneous” means. No backdating. No guessing.
- Practice mock inspections quarterly. Don’t wait for the real one.
- Use digital systems that auto-log timestamps, user IDs, and changes. Paper logs are a liability.
- When you get a Form 483, don’t panic. Don’t over-explain. Answer directly, show root cause, and prove you fixed it.
Transparency doesn’t mean total openness. It means accountability. The FDA isn’t trying to catch you off guard - they’re trying to make sure you’re not hiding anything. And in a world where millions rely on your product, that’s not just regulation. It’s responsibility.
Can the FDA inspect my facility without warning?
Yes - but only under specific conditions. For foreign facilities, the FDA is increasing unannounced inspections to 35% of all visits by the end of 2025. For domestic facilities, most inspections are still scheduled, but the FDA can conduct unannounced inspections if there’s reason to believe there’s a serious compliance issue, such as a pattern of product failures or whistleblower reports.
What records does the FDA have the right to see during an inspection?
The FDA can review all records tied to current Good Manufacturing Practices (CGMP), including batch production records, validation protocols, equipment logs, deviation reports, complaint investigations, and corrective and preventive action (CAPA) plans. They cannot review internal quality assurance audit reports unless the inspection is “for-cause” and there’s evidence of systemic failure.
How long do I need to keep manufacturing records?
For pharmaceuticals, you must retain records for at least one year after the product’s expiration date. For medical devices, records must be kept for the life of the device plus two years. All records must be stored in a way that allows quick retrieval during an inspection.
What is a Form FDA 483, and what happens after I get one?
Form FDA 483 is a list of observations made by FDA inspectors during a facility visit. It’s not a fine or legal notice, but it’s serious. You have 15 business days to respond with a detailed corrective action plan. If your response is inadequate, the FDA may issue a warning letter, which can lead to product seizures, import bans, or legal action.
Are Remote Regulatory Assessments (RRAs) replacing physical inspections?
No, RRAs are not replacing physical inspections - they’re supplementing them. RRAs allow the FDA to review records remotely through digital access, video walkthroughs, or data sharing. They’re faster and less disruptive, but they don’t generate Form 483s and cannot replace a full physical inspection for high-risk facilities or when serious compliance issues are suspected.
